Comparison
SOC 2 vs DORA
SOC 2 (Trust Services Criteria) · DORA (Regulation (EU) 2022/2554) · data 2026-10-27
Requirement-level comparison of SOC 2 (Trust Services Criteria) and DORA (Regulation (EU) 2022/2554), in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 22 DORA (Regulation (EU) 2022/2554) requirements, 20 map to something in SOC 2, 1 are only loosely related, and 1 have no mapping in our data.
DORA here means the articles that bind financial entities, mapped editorially at paragraph level. The technical standards that add detail, such as Delegated Regulation (EU) 2024/1774, are not mapped, so technical topics they cover show no link.
Likely new work: DORA requirements with no mapping to SOC 2 (1)
| DORA | Requirement | Match | SOC 2 | Evidence |
|---|---|---|---|---|
| Chapter II: ICT risk management · 1 | ||||
| Art.7 | ICT systems, protocols and tools | No mapping in our data | — | No mapping to SOC 2 in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (1)
| DORA | Requirement | Match | SOC 2 | Evidence |
|---|---|---|---|---|
| Chapter VI: Information sharing · 1 | ||||
| Art.45 | Information-sharing arrangements on cyber threat information and intelligence | CC3.2CC3.3CC3.4 | Only shares CSF ID.RA-03: related, not a mapping | |
Mapped (20)
| DORA | Requirement | Match | SOC 2 | Evidence |
|---|---|---|---|---|
| Chapter II: ICT risk management · 10 | ||||
| Art.5 | Governance and organisation | Editorial | CC3.1CC5.1CC9.1+9 | Same topic: Risk Management (editorial pick) |
| Art.6 | ICT risk management framework | Editorial | CC3.1CC5.1CC9.1+8 | Same topic: Risk Management (editorial pick) |
| Art.8 | Identification | Editorial | C1.1CC3.1CC6.1+4 | Same topic: Data Classification, Business Environment, Asset Management (editorial pick) |
| Art.9 | Protection and prevention | Editorial | CC7.2C1.2CC6.5+6 | Same topic: Cont. Monitoring, Data Protection (editorial pick) |
| Art.10 | Detection | Editorial | CC7.2CC7.3 | Same topic: Intrusion Detection, Anomaly Detection, SIEM / SOC (editorial pick) |
| Art.11 | Response and recovery | Editorial | A1.1A1.2CC9.1+4 | Same topic: Business Continuity (editorial pick) |
| Art.12 | Backup policies and procedures, restoration and recovery procedures and methods | Editorial | A1.2A1.3 | Same topic: Backup & Recovery, Disaster Recovery (editorial pick) |
| Art.13 | Learning and evolving | Editorial | CC7.4CC7.5CC1.4+1 | Same topic: Forensics, Lessons Learned, Awareness & Training (editorial pick) |
| Art.14 | Communication | Editorial | CC2.3 | Same topic: Communication (editorial pick) |
| Art.16 | Simplified ICT risk management framework | Editorial | CC3.1CC5.1CC9.1 | Same topic: Risk Management (editorial pick) |
| Chapter III: ICT-related incidents · 3 | ||||
| Art.17 | ICT-related incident management process | Editorial | CC7.3CC7.4CC2.3 | Same topic: Incident Response, Communication (editorial pick) |
| Art.18 | Classification of ICT-related incidents and cyber threats | Editorial | CC2.3CC7.3CC7.4 | Same topic: Reporting, Incident Response (editorial pick) |
| Art.19 | Reporting of major ICT-related incidents and voluntary notification of significant cyber threats | Editorial | CC2.3 | Same topic: Reporting (editorial pick) |
| Chapter IV: Resilience testing · 4 | ||||
| Art.24 | General requirements for the performance of digital operational resilience testing | Editorial | CC3.1CC5.1CC9.1 | Same topic: Risk Management (editorial pick) |
| Art.25 | Testing of ICT tools and systems | Editorial | CC7.1 | Same topic: Vulnerability Mgmt (editorial pick) |
| Art.26 | Advanced testing of ICT tools, systems and processes based on TLPT | Editorial | CC7.1 | Same topic: Vulnerability Mgmt (editorial pick) |
| Art.27 | Requirements for testers for the carrying out of TLPT | Editorial | CC7.1 | Same topic: Vulnerability Mgmt (editorial pick) |
| Chapter V: ICT third-party risk · 3 | ||||
| Art.28 | General principles | Editorial | CC9.2 | Same topic: Supply Chain Risk (editorial pick) |
| Art.29 | Preliminary assessment of ICT concentration risk at entity level | Editorial | CC9.2 | Same topic: Supply Chain Risk (editorial pick) |
| Art.30 | Key contractual provisions | Editorial | CC9.2 | Same topic: Cloud Security, Vendor Risk Mgmt (editorial pick) |
Of 61 SOC 2 (Trust Services Criteria) requirements, 34 map to something in DORA, 2 are only loosely related, and 25 have no mapping in our data.
AICPA's SOC 2 mappings aren't openly licensed, so every SOC 2 link here is ControlMapping editorial: criteria we haven't mapped can't match. Processing-integrity (PI) criteria and most privacy (P) criteria have no equivalent in security frameworks.
Likely new work: SOC 2 requirements with no mapping to DORA (25)
| SOC 2 | Requirement | Match | DORA | Evidence |
|---|---|---|---|---|
| CC2 Communication and information · 1 | ||||
| CC2.1 | Quality information to support internal control | No mapping in our data | — | No mapping to DORA in our data. |
| CC8 Change management · 1 | ||||
| CC8.1 | Change management for infrastructure, data and software | No mapping in our data | — | No mapping to DORA in our data. |
| P Privacy · 18 | ||||
| P1.1 | Privacy notice | No mapping in our data | — | No mapping to DORA in our data. |
| P2.1 | Choice and consent | No mapping in our data | — | No mapping to DORA in our data. |
| P3.1 | Collection limited to privacy objectives | No mapping in our data | — | No mapping to DORA in our data. |
| P3.2 | Explicit consent where required | No mapping in our data | — | No mapping to DORA in our data. |
| P4.1 | Use limited to privacy objectives | No mapping in our data | — | No mapping to DORA in our data. |
| P4.2 | Retention of personal information | No mapping in our data | — | No mapping to DORA in our data. |
| P4.3 | Disposal of personal information | No mapping in our data | — | No mapping to DORA in our data. |
| P5.1 | Data subject access | No mapping in our data | — | No mapping to DORA in our data. |
| P5.2 | Correction of personal information | No mapping in our data | — | No mapping to DORA in our data. |
| P6.1 | Disclosure to third parties with consent | No mapping in our data | — | No mapping to DORA in our data. |
| P6.2 | Record of authorized disclosures | No mapping in our data | — | No mapping to DORA in our data. |
| P6.3 | Record of unauthorized disclosures | No mapping in our data | — | No mapping to DORA in our data. |
| P6.4 | Privacy commitments from third parties | No mapping in our data | — | No mapping to DORA in our data. |
| P6.5 | Notification by third parties of unauthorized disclosures | No mapping in our data | — | No mapping to DORA in our data. |
| P6.6 | Breach notification to affected individuals | No mapping in our data | — | No mapping to DORA in our data. |
| P6.7 | Accounting of disclosures to data subjects | No mapping in our data | — | No mapping to DORA in our data. |
| P7.1 | Quality of personal information | No mapping in our data | — | No mapping to DORA in our data. |
| P8.1 | Handling privacy inquiries, complaints and disputes | No mapping in our data | — | No mapping to DORA in our data. |
| PI1 Processing integrity · 5 | ||||
| PI1.1 | Information about processing objectives | No mapping in our data | — | No mapping to DORA in our data. |
| PI1.2 | Controls over system inputs | No mapping in our data | — | No mapping to DORA in our data. |
| PI1.3 | Controls over system processing | No mapping in our data | — | No mapping to DORA in our data. |
| PI1.4 | Controls over system outputs | No mapping in our data | — | No mapping to DORA in our data. |
| PI1.5 | Storing inputs, items in processing and outputs | No mapping in our data | — | No mapping to DORA in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (2)
| SOC 2 | Requirement | Match | DORA | Evidence |
|---|---|---|---|---|
| CC5 Control activities · 1 | ||||
| CC5.2 | General controls over technology | Art.28(8)Art.30(2) | Only shares CSF PR.PS-01: related, not a mapping | |
| CC6 Logical and physical access · 1 | ||||
| CC6.8 | Preventing or detecting unauthorized or malicious software | Art.9(1)Art.9(2)Art.9(3)(a)+5 | Only shares CSF DE.CM-09, PR.DS-02: related, not a mapping | |
Mapped (34)
| SOC 2 | Requirement | Match | DORA | Evidence |
|---|---|---|---|---|
| A1 Availability · 3 | ||||
| A1.1 | Capacity management to meet availability commitments | Editorial | Art.11(1)Art.11(4)Art.11(6) | Same topic: Business Continuity (editorial pick) |
| A1.2 | Environmental protections, backups and recovery infrastructure | Editorial | Art.11(1)Art.11(4)Art.11(6)+4 | Same topic: Business Continuity, Disaster Recovery (editorial pick) |
| A1.3 | Testing recovery plan procedures | Editorial | Art.11(3)Art.11(6)Art.12(4)+1 | Same topic: Recovery Planning, Disaster Recovery (editorial pick) |
| C1 Confidentiality · 2 | ||||
| C1.1 | Identifying and protecting confidential information | Editorial | Art.8(1) | Same topic: Data Classification (editorial pick) |
| C1.2 | Disposing of confidential information | Editorial | Art.9(2)Art.9(3)(c)Art.9(3)(d) | Same topic: Data Protection (editorial pick) |
| CC1 Control environment · 5 | ||||
| CC1.1 | Commitment to integrity and ethical values | Editorial | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Same topic: Governance Policy (editorial pick) |
| CC1.2 | Board independence and oversight of internal control | Editorial | Art.5(2)(c)Art.5(3)Art.6(4) | Same topic: Roles & Responsibilities (editorial pick) |
| CC1.3 | Structures, reporting lines, authorities and responsibilities | Editorial | Art.5(2)(c)Art.5(3)Art.6(4) | Same topic: Roles & Responsibilities (editorial pick) |
| CC1.4 | Commitment to attracting, developing and retaining competent people | Editorial | Art.5(4)Art.13(6) | Same topic: Awareness & Training (editorial pick) |
| CC1.5 | Accountability for internal control responsibilities | Editorial | Art.5(2)(c)Art.5(3)Art.6(4) | Same topic: Roles & Responsibilities (editorial pick) |
| CC2 Communication and information · 2 | ||||
| CC2.2 | Internal communication of objectives and responsibilities | Editorial | Art.5(4)Art.13(6) | Same topic: Awareness & Training (editorial pick) |
| CC2.3 | Communication with external parties | Editorial | Art.11(2)(e)Art.11(7)Art.14(1)+6 | Same topic: Comms & Restore, Communication (editorial pick) |
| CC3 Risk assessment · 4 | ||||
| CC3.1 | Objectives specified clearly enough to identify risks | Editorial | Art.5(2)(a)Art.6(1)Art.6(8)+4 | Same topic: Risk Management (editorial pick) |
| CC3.2 | Risk identification and analysis | Editorial | Art.8(2)Art.8(3)Art.8(7) | Same topic: Risk Assessment (editorial pick) |
| CC3.3 | Considering the potential for fraud | Editorial | Art.8(2)Art.8(3)Art.8(7) | Same topic: Risk Assessment (editorial pick) |
| CC3.4 | Identifying and assessing significant changes | Editorial | Art.8(2)Art.8(3)Art.8(7) | Same topic: Risk Assessment (editorial pick) |
| CC4 Monitoring activities · 2 | ||||
| CC4.1 | Ongoing and/or separate evaluations of controls | Editorial | Art.5(2)(f)Art.6(6)Art.6(7) | Same topic: Compliance (editorial pick) |
| CC4.2 | Communicating and remediating control deficiencies | Editorial | Art.5(2)(f)Art.6(6)Art.6(7) | Same topic: Compliance (editorial pick) |
| CC5 Control activities · 2 | ||||
| CC5.1 | Control activities that mitigate risks | Editorial | Art.5(2)(a)Art.6(1)Art.6(8)+2 | Same topic: Risk Management (editorial pick) |
| CC5.3 | Control activities deployed through policies and procedures | Editorial | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Same topic: Governance Policy (editorial pick) |
| CC6 Logical and physical access · 7 | ||||
| CC6.1 | Logical access security over information assets | Editorial | Art.8(1)Art.8(4)Art.8(6)+3 | Same topic: Asset Management (editorial pick) |
| CC6.2 | User registration, authorization and removal | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| CC6.3 | Role-based access, least privilege and segregation of duties | Editorial | Art.9(4)(c) | Same topic: Access Control, Privileged Access (editorial pick) |
| CC6.4 | Physical access restrictions | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| CC6.5 | Protection of data when assets are disposed of | Editorial | Art.9(2)Art.9(3)(c)Art.9(3)(d) | Same topic: Data Protection (editorial pick) |
| CC6.6 | Protection against threats from outside system boundaries | Editorial | Art.9(4)(b) | Same topic: Firewall / Net Seg (editorial pick) |
| CC6.7 | Restricting transmission, movement and removal of information | Editorial | Art.9(3)(a)Art.9(4)(d) | Same topic: Encryption (editorial pick) |
| CC7 System operations · 5 | ||||
| CC7.1 | Detecting configuration changes and new vulnerabilities | Editorial | Art.8(2)Art.9(4)(f)Art.25(1)+2 | Same topic: Vulnerability Mgmt, Patch Management (editorial pick) |
| CC7.2 | Monitoring system components for anomalies | Editorial | Art.9(1)Art.10(1)Art.10(2)+1 | Same topic: Cont. Monitoring, Intrusion Detection, Anomaly Detection (editorial pick) |
| CC7.3 | Evaluating security events to determine if they are incidents | Editorial | Art.10(2)Art.10(3)Art.11(2)(b)+3 | Same topic: SIEM / SOC, Incident Response (editorial pick) |
| CC7.4 | Responding to identified security incidents | Editorial | Art.11(2)(b)Art.11(2)(c)Art.13(2)+5 | Same topic: Incident Response, Mitigation, Forensics (editorial pick) |
| CC7.5 | Recovering from identified security incidents | Editorial | Art.11(2)(e)Art.11(3)Art.11(7)+3 | Same topic: Comms & Restore, Recovery Planning (editorial pick) |
| CC9 Risk mitigation · 2 | ||||
| CC9.1 | Mitigating risks from business disruptions | Editorial | Art.5(2)(a)Art.6(1)Art.6(8)+5 | Same topic: Risk Management (editorial pick) |
| CC9.2 | Managing vendor and business partner risk | Editorial | Art.28(2)Art.28(3)Art.28(4)+6 | Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick) |
By topic
Both cover (37):
Governance PolicyAwareness & TrainingRisk ManagementSupply Chain RiskRoles & ResponsibilitiesComplianceAsset ManagementRisk AssessmentBusiness EnvironmentData ClassificationVulnerability MgmtAccess ControlMulti-Factor AuthEncryptionData ProtectionBackup & RecoveryPrivileged AccessFirewall / Net SegPatch ManagementCloud SecurityCont. MonitoringLogging & AuditIntrusion DetectionAnomaly DetectionSIEM / SOCIncident ResponseForensicsCommunicationMitigationReportingRecovery PlanningBusiness ContinuityLessons LearnedComms & RestoreDisaster RecoveryVendor Risk MgmtPhysical Security
Only SOC 2 (9):
Endpoint ProtectionSecure ConfigSecure DevelopmentEmail SecurityWeb SecurityZero TrustMobile SecurityWAFDLP
Only DORA (2):
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.